Roadmap
This is the public-safe summary of the plan. It is intent, not a delivery promise, and dates are deliberately absent — the order is the useful part.
Where things stand
Section titled “Where things stand”The network product is built and running: the data path, the inventory, the detection models, the incident workflow, the optional analyst and the dashboard. The connector framework runs with a live read-only UniFi source, device naming resolves speaking names hourly, and the telemetry client registers the installation and sends its daily heartbeat. Device identity phase one stays behind a feature flag that is off by default.
What is not done: the licence server and the purchase path, response execution, the mail module, the endpoint agent, and the open-source split of the repository itself.
The order
Section titled “The order”1. Finish the network product in operation. Live feeds, a started baseline, and the operational proofs that go with them: a tested restore, 24 hours of load observation, a controlled fault with catch-up, real alert and recovery delivery. The learning phase runs in parallel and cannot be compressed.
2. Connector framework and identity sources. The framework first — deliberately, because building connectors before the framework produces two shapes and the rebuild costs more than the original. Then the sources the identity model needs: firewall DHCP leases, and mDNS/SSDP names. Without those the inventory cannot keep a rotating device as one device, and everything downstream of the inventory is worth less.
3. Device identity. The full model, its timeline, merge candidates, the split endpoint, and the scheduled job. This is the critical path: today a device identifier can still be derived from an address, and that is the single largest correctness problem in the product.
4. Free/Pro foundation. The licensing model — the licence server, short-lived signed entitlement tokens, seat binding per installation, revocation at the next renewal and the 72-hour grace behaviour — plus the capability registry, the extension protocol, the billing path, and a signed update channel with a rollback proof. The instance registry that the seat binding depends on is specified and its appliance client is built.
5. Premium baseline and outputs. The remaining first-round connectors — hypervisor API, home automation, controller IDS and application classification — plus the outputs that make the product usable without watching it: webhook, metrics, chat and mail sinks, and two free threat-intelligence feeds.
6. Open-source split and publication. Separating site-specific data into a private repository, extracting the Pro modules behind interfaces with a disabled fallback, a cleaned export with new history and a secret scan over that history, a reproducible installation and a demo that needs no real network, and an extension SDK with reference implementations.
7. Response executor. Fully specified. Roughly a third of its work touches no firewall at all — the gate, the calibration, the migration, the API and the fake-firewall test suite — and can be brought forward. Its gate is an isolated firewall pair passing every proof, then a live canary against an address the operator owns, with automatic mode staying off until the policy gates pass.
8. Email security, phase one. Read-only first: real inbound and outbound mail events, rejections, authentication verdicts and aggregate reports, tenant-bound. Quarantine and blocking are a write path into a mail server and wait for phase one to be accepted.
9. Asset depth without an agent. A fact model where every fact carries its source, confidence and age; passive derivation; layer-2 inventory sources; behaviour groups with a self-comparison fallback. Its success criterion is measured, not assumed: if peer groups do not demonstrably reduce false alarms after two weeks, the feature stays off.
Deliberately not in the next twelve months
Section titled “Deliberately not in the next twelve months”| Topic | Why |
|---|---|
| Managed multi-tenant hosting for third parties | Needs dedicated nodes, resolved single points of failure and a data-processing agreement. Only sensible after direct customers exist. |
| Endpoint agent | The largest potential gain, but only once identity, facts and billing stand. |
| Mail quarantine and blocking | A write path into a mail server. Only after phase one is accepted. |
| Local vulnerability matching | Depends on the agent. |
Longer-term detection work
Section titled “Longer-term detection work”These need four to eight weeks of real data before they can be evaluated at all, so they follow the statistical layer rather than replacing it:
- Bayesian baselines instead of exponential smoothing, giving a probability rather than a z-score.
- Per-group autoencoders on hourly features, using reconstruction error as an anomaly score. At a few hundred devices the appliance’s own CPU can train these overnight, once a week. A GPU would accelerate it; it is not a requirement.
- A small sequence model over the order of services and destinations, for chains such as scan, then file share, then upload.
- Embeddings, for “similar cases” and “devices that behave like this one”.
Principles that constrain all of it
Section titled “Principles that constrain all of it”- A model never blocks by itself.
- The cheap path first; the expensive one only on reported uncertainty or human escalation.
- Every model output records its model, prompt version and evidence.
- Features are judged against measured benefit relative to the detection that already exists. A feature with no measurable benefit is removed, not kept for the feature list.